For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

IheartF5_45022's avatar
IheartF5_45022
Icon for Nacreous rankNacreous
Sep 09, 2014

Either blind luck, or the persistence entry must be constantly maintained for this client. A possible reason is that the client may always creates new connections within the source address profile timeout value (default 180s) of another connection closing. Client use of TCP keepalive could also help here (or else they are constantly sending traffic).

You can view the persistence records like this;-

tmsh show ltm persistence persist-records

  • nov1ce_120072's avatar
    nov1ce_120072
    Icon for Nimbostratus rankNimbostratus
    Sep 09, 2014
    Thank you! I think it's the second option, because from the fw logs I see them connecting every 2 mins and they are constantly sending traffic. I also see the customer IP in Statistics > Local Traffic > Persistence Records with the Age ~5-10 seconds. Does it mean I won't be able to disable this node for maintenance without them noticing it? Since they always end up on one node, if I disable it from the pool will they get timeout and get transferred to another node?